New Bluekit Phishing-as-a-Service Bypasses MFA to Steal Microsoft Login Credentials

Bluekit is a mature Phishing-as-a-Service platform that uses a novel Browser-in-the-Middle (BitM) approach—streaming a live Microsoft login page from an attacker-controlled browser via rrweb—to harvest credentials and bypass MFA and device-bound session protections. Netcraft observed roughly 70 live hostnames, and the report details Bluekit’s layered anti-analysis techniques and recommended detection signals (WebSocket DOM streams, rrweb presence, custom CAPTCHAs, large obfuscated JS bundles, WebRTC IP mismatch) for defenders.